I would open a tech support track if you are seeing some type of error.  They should be able to confirm proper behavior for you. https://www.sas.com/en_us/contact/technical-support.html ... View more

You can always send an email to support@sas.com They go over what to include on this page. https://www.sas.com/en_us/contact/technical-support.html ... View more

I think the first thing the community will need to know is which version of SAS AML are you using? ... View more

@sandeep_reddy ,   A quick check of the SAS.com website and it looks to me like ECM on 9.4m3 was released in around 2015, and was put on Limited Support about 2 years ago. Java 8 is supported for ECM or m3, and I was able to find a SAS note to that effect.  SAS Usage Note 56203   It states that Java 8 is not supported until 9.4m6.  That likely means that your ECM instance on 9.4m3 was not written to work with Java 8, nor tested against it.  I suspect that is why it is giving you trouble.   Additionally, I would say that if you change your SOLR and encounter issues it could mean your ECM is unsupported.  Most people use ECM for fraud case management of Anti-Money Laundering (AML) use cases.  I do know that if you are using AML I believe you could potentially upgrade to the AML 7.1 version.  Is it possible you could upgrade?  AML 7.1 Installation Note 66795    If using that version of SOLR is a priority then an upgrade is the only supported option I can think of for you at this time.  If it is not an AML use case, you might consider looking at SAS Visual Investigator on Viya as many fraud case management customers have moved to that software.  I'm also certain tech support can guide you to the correct answer as well. 😉  Good Luck! ... View more

Close Alert and Reactivate After an Increase are separate and distinct disposition actions.  If you have Close Alert checked it will invalidate your reactivate option completely.   I'd unchecked the Close option if that is the case and try again with the Reactivate and whatever % threshold you felt was appropriate. ... View more

So it sounds like your flow is creating a new alert.  If you don't think that should be happening you might start checking a few areas.  Check your alert score aggregation policy to make sure it represents what you are trying to enable.   When the Do not compute a score from the provided activity or Compute the score from the activity in the current alerting event score aggregation policy is selected, the scorecard displays only the scenario-fired events in the current alerting event. When the Compute the score from the unique alerting activity in all the alerting events score aggregation policy is selected, the scorecard displays all the scenario-fired events in the current alerting event as well as all the unique scenario-fired events in prior alerting events for this alert version. When the Compute the score from all the activity in all the alerting events score aggregation policy is selected, the scorecard displays all the scenario-fired events in the current alerting event as well as all the events in prior alerting events for this alert version.   From what you said it sounds like the system is finding "new" activity and alerting on it.   Example: An alert comes up for Joe Smith and a user dispositions it.  That disposition creates a case and closes the alert.  That alert only stays closed until new activity that meets the alerting threshold criteria comes into the system.  If that isn't what you are wanting in terms of behavior you could look at the alert disposition option to keep the alert suppressed until the score in creases by % or X amount.   Reactivate after a Score Increase Suppresses the alert and keeps it suppressed unless its score changes. You can specify whether the score must increase by a percentage or by an exact amount. You can indicate that the alert should be reactivated if the score goes above a specified value. ... View more

Here is an SGF paper on PROC JSON.  I believe that is how many of the current deployments output the data to JSON.  https://www.sas.com/content/dam/SAS/support/en/sas-global-forum-proceedings/2019/3506-2019.pdf ... View more

It can be purchased as an addon to Detection & Investigation.  I'd reach out to your account executive and they could assist you with more information. ... View more

That really won't be helpful in this instance.  I'd say open a tech support track if you are having problems or possible have our professional services group setup an engagement to assist you.  Tech support can be emailed at support@sas.com.  Good luck! ... View more

We have the Alert REST endpoint documented in the VI admin guide.  It has examples included.  I would go there and find the one you need for your use case.   Directly from the guide example:   http://myserver/svi-alert/alerts/alertDecisions/{AD_BUILT_IN_CLOSE} The call includes the following payload:   { "version": 1, "dispositionId": "AD_BUILT_IN_CLOSE", "promptForQueue": false, "promptForActivationTime": false, "promptForDocument": false, "documentFields": {}, "promptForScenarioFired": false, "promptForRest": false, "restFields": {}, "modifiedOverride": false, "promptForNoteFlag": false, "promptForReasonFlag": false, "alertDispositionName": "Close Immediately", "alerts": [ { "creationTimeStamp": "2019-10-11T17:52:58.731Z", "modifiedTimeStamp": "2019-10-16T21:14:04.960Z", "createdBy": "sas.svi-alert", "modifiedBy": "userID", "version": 1, "domainId": "svidomain", "alertId": "35809751744", "alertVersion": 1, "alertVersionTimeStamp": "2019-10-11T17:52:58.731Z", "actionableEntityType": "individual_customers", "actionableEntityId": "343648989", "actionableEntityLabel": "Jan-Joos Willeboords", "initialScore": 9081, "currentScore": 9081, "highScore": 9081, "alertOriginCode": "BATCH", "alertTypeCode": "KYC", "alertTriggerText": "Customer profile score 9081", "statusTimeStamp": "2019-10-11T17:52:58.731Z", "queueEntryTimeStamp": "2019-10-11T17:52:58.749Z", "checkoutUserId": "userID", "checkoutTimeStamp": "2019-10-16T21:14:04.907Z", "alertServiceCount": 1, "userServiceTimeStamp": "2019-10-16T21:14:04.907Z", "systemServiceTimeStamp": "2019-10-11T17:52:58.812Z", "alertStatusId": "ACTIVE", "initialAlertingEventId": "AL148", "currentAlertingEventId": "AL148", "highAlertingEventId": "AL148", "queueId": "queue_kyc", "lastUpdateNumber": 3, "logicalDeleteFlag": false, "autoCloseTimeStamp": "2020-02-09T00:00:00.000Z" } ] } ... View more

There are no automatic “data watchers” in VI that trigger activity.   I think you would need to create a batch job that runs periodically looking for the changes you are interested in. When those data changes are found, you could make a rest call to close the alert. ... View more

This was completed by R&D in the most recent Visual Investigator release which just went out.  You could get the new VI 10.7 and you would be able to use the scheduling capability.  You need a saved Flow in VI.  Then go to published versions you would see an option labeled, "Deploy the Flow for Scheduling". ... View more

I'm not sure what exactly you are trying to schedule in Visual Investigator.   We have had requests to integrate Scenario Administration (Flows) for alert generation with the SAS Environment Manager scheduling service.  Is that the specific type of scheduling you are requesting or is it something else? ... View more